refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

system/machines/desktop/README.md

@@ -0,0 +1,19 @@
+## Hardware
+
+| Component   | Model                              |
+|-------------|------------------------------------|
+| Motherboard | MSI B760 GAMING PLUS WIFI          |
+| CPU         | Intel Core i7-12700KF (12th Gen)   |
+| GPU         | NVIDIA GeForce GTX 1650            |
+| Storage     | 2x 2TB Crucial MX500 SSD           |
+
+## Memory
+
+| Slot    | Size | Manufacturer   | Part Number | Speed      |
+|---------|------|----------------|-------------|------------|
+| DIMM A1 | -    | -              | -           | -          |
+| DIMM A2 | 16GB | Team Group Inc | UD5-6000    | 4800 MT/s  |
+| DIMM B1 | -    | -              | -           | -          |
+| DIMM B2 | 16GB | Team Group Inc | UD5-6000    | 4800 MT/s  |
+
+**Total: 32GB DDR5**

system/machines/desktop/default.nix

@@ -0,0 +1,14 @@
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+      (import ./modules/disko)
+    inputs.home-manager.nixosModules.home-manager
+      (import ./modules/home-manager)
+    ../../../user
+    ../../keys
+    ./hardware.nix
+    ./system.nix
+  ];
+}

system/machines/desktop/hardware.nix

@@ -0,0 +1,83 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+with lib;
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  options.monitors = mkOption {
+    type = types.listOf (types.submodule {
+      options = {
+        name = mkOption { type = types.str; example = "HDMI-A-1"; };
+        width = mkOption { type = types.int; };
+        height = mkOption { type = types.int; };
+        x = mkOption { type = types.int; };
+        y = mkOption { type = types.int; };
+        scale = mkOption { type = types.float; };
+        refreshRate = mkOption { type = types.int; };
+      };
+    });
+    default = [];
+    description = "System monitor configuration";
+  };
+
+  config = {
+    monitors = [
+      { name = "HDMI-A-1"; width = 1920; height = 1080; x = 0;    y = 0; scale = 1.0; refreshRate = 60; }
+      { name = "DP-1";     width = 1920; height = 1080; x = 1920; y = 0; scale = 1.0; refreshRate = 60; }
+    ];
+
+    boot = {
+      initrd = {
+        availableKernelModules = [ "vmd" "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+        kernelModules = [ "dm-snapshot" ];
+      };
+      extraModulePackages = [ ];
+      kernelPackages = pkgs.linuxPackages_zen;
+      kernelParams = [ "intel_iommu=on" ];
+      kernelModules = [ "kvm-intel" "virtio" "vfio-pci" "coretemp" ];
+    };
+
+    environment.systemPackages = with pkgs; [
+      linuxHeaders
+
+      vulkan-headers
+      vulkan-loader
+      vulkan-tools
+      vulkan-extension-layer
+
+      mesa
+      mesa-demos
+
+      cudaPackages.cudatoolkit
+      cudaPackages.cudnn
+    ];
+
+    hardware = {
+      cpu = {
+        intel = {
+          updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+        };
+      };
+      nvidia = {
+        open = true;
+        modesetting.enable = true;
+        nvidiaSettings = true;
+        package = config.boot.kernelPackages.nvidiaPackages.stable;
+      };
+      graphics = {
+        enable = true;
+        enable32Bit = true;
+      };
+    };
+
+    virtualisation.libvirtd = {
+      enable = true;
+      qemu = {
+        runAsRoot = true;
+      };
+    };
+
+    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+    powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
+  };
+}

system/machines/desktop/modules/disko/default.nix

@@ -0,0 +1,57 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-CT2000MX500SSD1_2137E5D2D47D";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            primary = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "nix";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg = {
+      nix = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "5%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          home = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/home";
+            };
+          };
+        };
+      };
+    };
+  };
+}

system/machines/desktop/modules/home-manager/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./home.nix
+  ];
+}

system/machines/desktop/modules/home-manager/home.nix

@@ -0,0 +1,54 @@
+{ config, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.extraSpecialArgs = {
+    monitors = config.monitors;
+  };
+  home-manager.users.${config.user.name} = {
+    imports = [
+      ../../../../../user
+      ../../../../../user/home.nix
+      ../../../../../user/modules
+    ];
+
+    home.stateVersion = "23.11";
+
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+      matchBlocks = {
+        "*" = {
+          serverAliveInterval = 60;
+          serverAliveCountMax = 3;
+        };
+        "server" = {
+          hostname = "192.168.0.154";
+          user = "bryan";
+        };
+      };
+    };
+
+    # Machine-specific modules
+    modules.user = {
+      vim.enable = false;
+      security.yubikey.enable = true;
+
+      utils = {
+        dev.enable = true;
+        irc.enable = true;
+        writing.enable = true;
+      };
+
+      gui = {
+        wm.hyprland.enable = true;
+        browser.firefox.enable = true;
+        alacritty.enable = true;
+        corn.enable = true;
+        fun.enable = true;
+        utils.enable = true;
+      };
+    };
+  };
+}

system/machines/desktop/system.nix

@@ -0,0 +1,148 @@
+{ pkgs, lib, config, ... }:
+
+let
+  gpgEnabled = lib.any
+    (user: user.modules.user.security.gpg.enable or false)
+    (lib.attrValues config.home-manager.users);
+
+in
+{ system.stateVersion = "23.11";
+
+  users.users = {
+    ${config.user.name} = {
+      isNormalUser = true;
+      extraGroups = config.user.groups
+        ++ [ "video" "audio" "kvm" "libvirtd" "dialout" ];
+      openssh.authorizedKeys.keys = [ "${config.user.keys.ssh.graphone}" ];
+    };
+  };
+
+  nix = {
+    channel.enable = false;
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+      keep-going = true
+    '';
+    settings = {
+      auto-optimise-store = true;
+      trusted-users = [ "${config.user.name}" ];
+      substitute = true;
+      max-jobs = "auto";
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 5;
+      #memtest86.enable = true;
+    };
+
+    efi = {
+      canTouchEfiVariables = true;
+    };
+    #timeout = null;
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      vim
+      git
+      usbutils
+    ];
+    pathsToLink = [
+      "/share/applications"
+      "/share/xdg-desktop-portal"
+    ];
+  };
+
+  fonts.packages = with pkgs; [
+    nerd-fonts.terminess-ttf
+  ];
+
+  security = {
+    sudo = {
+      wheelNeedsPassword = false;
+      execWheelOnly = true;
+    };
+    polkit.enable = true;
+  };
+
+  time = {
+    timeZone = "America/New_York";
+    hardwareClockInLocalTime = true;
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  networking = {
+    hostName = "desktop";
+    useDHCP = lib.mkDefault true;
+    networkmanager.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 22 80 443 ];
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      # Explicit subdomains -> local server
+      address = [
+        "/git.ramos.codes/192.168.0.154"
+        "/ln.ramos.codes/192.168.0.154"
+        "/photos.ramos.codes/192.168.0.154"
+        "/test.ramos.codes/192.168.0.154"
+        "/electrum.ramos.codes/192.168.0.154"
+        "/immich.ramos.codes/192.168.0.154"
+        "/forgejo.ramos.codes/192.168.0.154"
+        "/frigate.ramos.codes/192.168.0.154"
+      ];
+      server = [ "192.168.0.1" ];
+    };
+  };
+
+  services = {
+    pcscd.enable = gpgEnabled;
+    timesyncd = lib.mkDefault {
+      enable = true;
+      servers = [
+        "0.pool.ntp.org"
+        "1.pool.ntp.org"
+        "2.pool.ntp.org"
+        "3.pool.ntp.org"
+      ];
+    };
+    pipewire = {
+      enable = true;
+      audio.enable = true;
+
+      wireplumber.enable = true;
+
+      pulse.enable = true;
+      jack.enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+    };
+    openssh = {
+      enable = true;
+      startWhenNeeded = false;
+      settings = {
+        X11Forwarding = false;
+        PasswordAuthentication = false;
+      };
+    };
+  };
+}